|By Jon Shende||
|September 10, 2012 07:00 AM EDT||
As cloud computing technologies and offerings mature and evolve in its services to customers, one common consumer use will be that of the Software as a Service (SaaS) model.
My earlier articles have touched on the various models, risks, security and forensics at several levels. There is also a plethora of resources available now that end users can educate themselves with that are freely available online.
This article will focus on aspects of security that impact the SaaS environment as developed, presented or augmented by me for several Cloud Computing projects.
Before we proceed in the subject matter, a brief clarification of what I refer to as the cloud follows. Keep in mind that this term "cloud computing" is now being used to describe a broad range of services to include product descriptors that sits outside the common definition of the cloud.
For ease of reference I will refer to the National Institute of Standards and Technology (NIST)  definition of which the following is a part. "Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction."
Over the years since the concept of Cloud Computing evolved we have seen an accepted concept of the "Cloud Computing Stack", with its three distinct categories: Software as a Service, Platform as a Service and Infrastructure as a Service; where the IaaS Is the platform upon which PaaS rests and which is turn has SaaS rests moving up from IaaS to SaaS.
It is important to keep this basic stack in mind as the building blocks of the Cloud Computing system and not get distracted by all the "as a Service" spring up across markets as we proceed with this article.
As we move more and more services into the Cloud ecosystem, there will always be concerns regarding security. However a prescriptive combination of both preventive and detective controls at those data centers housing the IaaS ecosystem is on the path to security compliance and event mitigation. These controls, as a step toward better cloud computing security should be assessed and assured to meet industry tested security controls, as well as regulatory and policy requirements. The same format can be modified and applied up the stack to the PaaS segment.
However it is at the SaaS layer that we can perceive additional challenges with cloud security. One critical area of concern stems from the potential risk that a client's data can be exposed to as it is stored within the storage system of its SaaS provider. This risk can potentially increase in the event of the SaaS provider in turn utilizing the services of a third party IaaS provider.
While effective data center security controls are good for inside a data center, web-services or applications outside this area are a growing target for application layer type attacks. This can lead to the loss of critical to sensitive customer data as well as intellectual property and other corporate data.
A challenge for the IT security professional here is how to implement a level of protection that meets IT Security control requirements as well as ensures compliance with information security regulations, E.g. PCI-DSS in the case of transactions via web services.
In both the traditional environments and cloud services infrastructure environments, we have firewalls tweaked and configured with rulebase automation as a best practice. However in the dynamic cloud environment I believe that having to manage firewall signatures for example, amongst other issues could be challenging and counter-productive.
Essentially we would need to implement security in a layered approach which should include the network, servers, databases and coding, augmented by a system that should have a defined security process based on the SaaS environment and its functionality. This should be an additive measure to augment other monitoring and logging systems deployed to secure this environment.
This system should also have the ability to implement tools that will be able to dynamically learn the behavior of an application supported by an automated mechanism, thus removing the need for signatures in the case of firewall systems as mentioned earlier.
Within the SaaS environment we need to ensure adequate security in input validation by SaaS end users, effective user authentication and authorization, proper data segregation with security encapsulation for data in motion using SSL (3.0 or above) or TLS (1.0 above), effective software patching policies and procedures by the SaaS provider working with its software vendors as well as a key generation strategy.
(While SSL/TLS is encryption for data in motion between a Web Server and a browser is a good practice, administrators should disable weak algorithms and ciphers residing on the Web Server).
There must also be assurance for uptime or availability that is formalized in a Service Level Agreement (SLA). Impact on environments supporting the SaaS ecosystem can be attacks impacting Network Security as well as the process for Backup and Recovery.
Researchers Bhadauria and Sanyal  stated "Two types of servers are used by SaaS: the Main Consistence Server (MCS) and Domain Consistence Server (DCS). Cache coherence is achieved by the cooperation between MCS and DCS. In SaaS, if the MCS is damaged, or compromised, the control over the cloud environment is lost. Hence securing the MCS is of great importance."
Moving away a bit from the technology of security in this environment, Cloud Computing and SaaS on a whole was in its infancy and in some circles denounced as a viable IT service (no names called here, but a tech company leader specializing in databases and now cloud products comes to mind).
In terms of regulations that impact web services and by extension SaaS, we can reference the Gramm-Leach-Bliley Act (GLBA)  passed in 1999, Sarbanes-Oxley Act (SOX) in 2002 , and the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule and Security Rule of 2003. All three of these regulations, although important in their relative environments (e.g. Customer Relationship Management (CRM), Enterprise Resource Planning (ERP), Intellectual Property systems (IPS) and Human Resources Systems), were not crafted to include elements of a SaaS environment then.
As a result there needs to be finite and focused addendums or improvement to these acts as was in the case of SAS 70 to SSAE 16 to meet this technological evolution.
Of importance is that, despite the security measures and attestations provided by a SaaS provider to assure a client of their security controls or compensating controls and compliance processes in place to meet regulatory and security standards; it is still the responsibility of a data owner to maintain industry regulated requirements to comply with confidentiality, integrity, non-repudiation and security control over sensitive to critical information.
So the challenge here is to ensure that a cloud client requirement (Security Policy, Strategy, Data Provenance, Operational and End-User Security) is part of the discussion with the cloud provider and most if not all requirements mirror.
The designation of data classification is part of another topic and should be the influenced by the result of risk impact and gap analysis.
As a closing point the value of vulnerability assessments and penetration tests within the SaaS environment is an important tool for an independent set of eyes to present information that a potential attacker will find and use against the SaaS. This is not only related to technology as is well known due to the rise of social engineering.
 A Survey on Security Issues in Cloud Computing www.ijcaonline.org › Archives › Volume 47 › Number 18, Rohit Bhadauria; Sugata Sanyal, 2012
 Jesse James Garrett (18 February 2005). "Ajax: A New Approach to Web Applications". AdaptivePath.com.
Grow your business with enterprise wearable apps using SAP Platforms and Google Glass. SAP and Google just launched the SAP and Google Glass Challenge, an opportunity for you to innovate and develop the best Enterprise Wearable App using SAP Platforms and Google Glass and gain valuable market exposure. In his session at @ThingsExpo, Brian McPhail, Senior Director of Business Development, ISVs & Digital Commerce at SAP, outlined the timeline of the SAP Google Glass Challenge and the opportunity for developers, start-ups, and companies of all sizes to engage with SAP today.
May. 28, 2015 03:00 AM EDT Reads: 4,985
Cultural, regulatory, environmental, political and economic (CREPE) conditions over the past decade are creating cross-industry solution spaces that require processes and technologies from both the Internet of Things (IoT), and Data Management and Analytics (DMA). These solution spaces are evolving into Sensor Analytics Ecosystems (SAE) that represent significant new opportunities for organizations of all types. Public Utilities throughout the world, providing electricity, natural gas and water, are pursuing SmartGrid initiatives that represent one of the more mature examples of SAE. We have s...
May. 27, 2015 11:00 PM EDT Reads: 6,007
The Internet of Things will put IT to its ultimate test by creating infinite new opportunities to digitize products and services, generate and analyze new data to improve customer satisfaction, and discover new ways to gain a competitive advantage across nearly every industry. In order to help corporate business units to capitalize on the rapidly evolving IoT opportunities, IT must stand up to a new set of challenges. In his session at @ThingsExpo, Jeff Kaplan, Managing Director of THINKstrategies, will examine why IT must finally fulfill its role in support of its SBUs or face a new round of...
May. 27, 2015 10:00 PM EDT Reads: 5,390
The true value of the Internet of Things (IoT) lies not just in the data, but through the services that protect the data, perform the analysis and present findings in a usable way. With many IoT elements rooted in traditional IT components, Big Data and IoT isn’t just a play for enterprise. In fact, the IoT presents SMBs with the prospect of launching entirely new activities and exploring innovative areas. CompTIA research identifies several areas where IoT is expected to have the greatest impact.
May. 27, 2015 09:00 PM EDT Reads: 4,898
Can call centers hang up the phones for good? Intuitive Solutions did. WebRTC enabled this contact center provider to eliminate antiquated telephony and desktop phone infrastructure with a pure web-based solution, allowing them to expand beyond brick-and-mortar confines to a home-based agent model. It also ensured scalability and better service for customers, including MUY! Companies, one of the country's largest franchise restaurant companies with 232 Pizza Hut locations. This is one example of WebRTC adoption today, but the potential is limitless when powered by IoT.
May. 27, 2015 09:00 PM EDT Reads: 6,406
One of the biggest challenges when developing connected devices is identifying user value and delivering it through successful user experiences. In his session at Internet of @ThingsExpo, Mike Kuniavsky, Principal Scientist, Innovation Services at PARC, described an IoT-specific approach to user experience design that combines approaches from interaction design, industrial design and service design to create experiences that go beyond simple connected gadgets to create lasting, multi-device experiences grounded in people's real needs and desires.
May. 27, 2015 09:00 PM EDT Reads: 6,007
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
May. 27, 2015 07:00 PM EDT Reads: 5,954
SYS-CON Events announced today that MetraTech, now part of Ericsson, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Ericsson is the driving force behind the Networked Society- a world leader in communications infrastructure, software and services. Some 40% of the world’s mobile traffic runs through networks Ericsson has supplied, serving more than 2.5 billion subscribers.
May. 27, 2015 06:45 PM EDT Reads: 1,325
The Internet of Things is not only adding billions of sensors and billions of terabytes to the Internet. It is also forcing a fundamental change in the way we envision Information Technology. For the first time, more data is being created by devices at the edge of the Internet rather than from centralized systems. What does this mean for today's IT professional? In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will addresses this very serious issue of profound change in the industry.
May. 27, 2015 06:00 PM EDT Reads: 921
SYS-CON Events announced today that BMC will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. BMC delivers software solutions that help IT transform digital enterprises for the ultimate competitive business advantage. BMC has worked with thousands of leading companies to create and deliver powerful IT management services. From mainframe to cloud to mobile, BMC pairs high-speed digital innovation with robust IT industrialization – allowing customers to provide amazing user experiences with optimized IT per...
May. 27, 2015 05:30 PM EDT Reads: 769
The Internet of Things is not new. Historically, smart businesses have used its basic concept of leveraging data to drive better decision making and have capitalized on those insights to realize additional revenue opportunities. So, what has changed to make the Internet of Things one of the hottest topics in tech? In his session at @ThingsExpo, Chris Gray, Director, Embedded and Internet of Things, discussed the underlying factors that are driving the economics of intelligent systems. Discover how hardware commoditization, the ubiquitous nature of connectivity, and the emergence of Big Data a...
May. 27, 2015 04:00 PM EDT Reads: 6,413
SYS-CON Events announced today that O'Reilly Media has been named “Media Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York City, NY. O'Reilly Media spreads the knowledge of innovators through its books, online services, magazines, and conferences. Since 1978, O'Reilly Media has been a chronicler and catalyst of cutting-edge development, homing in on the technology trends that really matter and spurring their adoption by amplifying "faint signals" from the alpha geeks who are creating the future. An active participa...
May. 27, 2015 03:37 PM EDT Reads: 508
The world is at a tipping point where the technology, the device and global adoption are converging to such a point that we will see an explosion of a world where smartphone devices not only allow us to talk to each other, but allow for communication between everything – serving as a central hub from which we control our world – MediaTek is at the heart of both driving this and allowing the markets to drive this reality forward themselves. The next wave of consumer gadgets is here – smart, connected, and small. If your ambitions are big, so are ours. In his session at @ThingsExpo, Jack Hu, D...
May. 27, 2015 12:49 PM EDT Reads: 511
SYS-CON Events announced today that DragonGlass, an enterprise search platform, will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. After eleven years of designing and building custom applications, OpenCrowd has launched DragonGlass, a cloud-based platform that enables the development of search-based applications. These are a new breed of applications that utilize a search index as their backbone for data retrieval. They can easily adapt to new data sets and provide access to both structured and unstruc...
May. 27, 2015 12:00 PM EDT Reads: 1,862
The 4th International Internet of @ThingsExpo, co-located with the 17th International Cloud Expo - to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA - announces that its Call for Papers is open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
May. 27, 2015 12:00 PM EDT Reads: 1,664
We’re entering a new era of computing technology that many are calling the Internet of Things (IoT). Machine to machine, machine to infrastructure, machine to environment, the Internet of Everything, the Internet of Intelligent Things, intelligent systems – call it what you want, but it’s happening, and its potential is huge. IoT is comprised of smart machines interacting and communicating with other machines, objects, environments and infrastructures. As a result, huge volumes of data are being generated, and that data is being processed into useful actions that can “command and control” thi...
May. 27, 2015 11:51 AM EDT Reads: 511
As the Internet of Things unfolds, mobile and wearable devices are blurring the line between physical and digital, integrating ever more closely with our interests, our routines, our daily lives. Contextual computing and smart, sensor-equipped spaces bring the potential to walk through a world that recognizes us and responds accordingly. We become continuous transmitters and receivers of data. In his session at @ThingsExpo, Andrew Bolwell, Director of Innovation for HP's Printing and Personal Systems Group, discussed how key attributes of mobile technology – touch input, sensors, social, and ...
May. 27, 2015 11:30 AM EDT Reads: 3,963
All major researchers estimate there will be tens of billions devices - computers, smartphones, tablets, and sensors - connected to the Internet by 2020. This number will continue to grow at a rapid pace for the next several decades. With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo, June 9-11, 2015, at the Javits Center in New York City. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be
May. 27, 2015 11:15 AM EDT Reads: 2,038
WebRTC defines no default signaling protocol, causing fragmentation between WebRTC silos. SIP and XMPP provide possibilities, but come with considerable complexity and are not designed for use in a web environment. In his session at @ThingsExpo, Matthew Hodgson, technical co-founder of the Matrix.org, discussed how Matrix is a new non-profit Open Source Project that defines both a new HTTP-based standard for VoIP & IM signaling and provides reference implementations.
May. 27, 2015 10:30 AM EDT Reads: 5,181
Buzzword alert: Microservices and IoT at a DevOps conference? What could possibly go wrong? In this Power Panel at DevOps Summit, moderated by Jason Bloomberg, the leading expert on architecting agility for the enterprise and president of Intellyx, panelists will peel away the buzz and discuss the important architectural principles behind implementing IoT solutions for the enterprise. As remote IoT devices and sensors become increasingly intelligent, they become part of our distributed cloud environment, and we must architect and code accordingly. At the very least, you'll have no problem fil...
May. 27, 2015 10:00 AM EDT Reads: 1,823